This vulnerability (CVE-2026-26167) involves a race condition (CWE-362) in the Windows Push Notifications component of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). The flaw arises from improper synchronization when multiple threads access shared resources concurrently, which can be exploited by an authorized local attacker to elevate privileges. The issue has been assigned a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released an official fix to address this vulnerability.

An authorized local attacker can exploit this race condition to elevate privileges on the affected system, potentially gaining higher-level access than intended. This could lead to full system compromise depending on the privileges escalated to. The vulnerability affects confidentiality, integrity, and availability of the system.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided security update from the Microsoft Security Response Center to remediate this issue. No additional mitigation steps are indicated beyond applying the official patch.